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Title 

TERMINAL AND REPOSITORY IN A TELECOMMUNICATIONS SYSTEM 
Technical field of the invention 

The present invention relates generally to a method 
for use in communications systems, and more particularly, the invention 
relates to a method of access independent global roaming, The invention 
further relates to a system and apparatus for carrying out the method. 

t Background of the invention 

A large number of fixed and mobile access standards 
are now available, such as Wideband-Code Division Multiple Access (W-CDMA), 
Universal Mobile Telephone System-Time Division Duplex (UMTS-TDD) , 
CDMA 2000, Wireless-Local Area Network (W-LAN) „ EDGE etc, all of which 
belong to the 3 rd generation wireless standards, Each type of access 
standard has its own particular network concept; where Mobile Internet 
Protocol (Mobile IP) and the General Packet Radio Service (GPRS) tunnelling 
protocol are the main two concepts. The invention, however, is not limited 
to the above mentioned concepts. 

Using methods presently available, interoperability 
between different network concepts is not guaranteed. This is mainly due 
to three obstacles. First, there is a lack of common subscriber profiles, 
service standards and authentication mechanisms, preventing enforcement 
of policies relating, but not limited to, access and service authorization, 
and accounting and mobility in different networks, Second 3 there is a lack 
of common Quality of Service (QoS) versus resource allocation paradigm 
in the access networks, due to a bottom up instead of a top down approach 
in designing the data link layers with respect to QoS requirements. 
Third, there is a lack of common higher layer standards in the terminals, 
preventing service transparency when user terminals, i.e, clients, roam 
between different networks that carry specific services. 

Thus, there is a problem with interoperability between 
heterogeneous networks mainly because of problems with authentication and 
service transparency in and between different networks. It is, of course, 
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theoretically possible to harmonise disparate networks at all of the above 
levels and thus creating interoperability. There however s a need for 
an organic way of integrating heterogeneous networks and thus providing 
access independent global roaming, 
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Summary of the invention 

The present invention therefore provides a solution 
to the problems of integrating heterogeneous networks, providing for access 
10 independent global roaming and access to serv ; ces via heterogeneous 
networks, without a need for harmonising disparate networks. 

An object of the invention is to provide access 
independent global roaming in heterogeneous networks, 

Another object of the invention is to provide policy 
15 enforcement and service transparency when terminals roam between different 
heterogeneous networks* 

The invention achieves the above mentioned objects in 
embodiments thereof by; 

moving at least essential or all service related 
20 functions out of the network into the periphery, i.e. clients or user 
terminals and servers, by separating service and access functions, 

conceiving the transport mechanism between clients or 
terminals and servers as a packet pipe, not necessarily adding extra value 
except transport and Quality of Service (QoS) classification thereof, 
25 separating the charging of transput from the charging 

of services and introducing real-time payment of transport > 

defining policies, basically a set of rights and 
obligations, in a policy definition point, e.g. operator servers* enforcing 
policies in a policy enforcement point residing in the client, e.g. the 
30 user terminal , and 

standardising and modularising a client or terminal 
architecture that supports the above entities. 

More specifically, the policies defined in the policy 
definition point are enforced locally in the user terminal in a local 
35 policy enforcement point instead of, as usual, in the network. By policies 
in this context is meant, among others, a set of rights and obligations 
pertaining to authentication of users, authorization to access and services 
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as well as purchasing and brokering cf transport resources and security. 
Accounting polities may govern the charging functions for access charging 
and service charging. By the separation of service and access functions, 
transport can be paid for separately, e.g. in real-time via a credit card, 
pre-paid card, cash card or the like and services can be paid for as usual 
e,g. as per invoice from a service provider, for example. 

The client or terminal thus acts more as a personal 
profile manager, enforcing policies, hence managing rights to services 
and access. Services and access are controlled in the terminal by the local 
policy enforcement point and the terminal /profile manager is access 
independent, since access can be purchased in real-time. Thus, t^e 
subscriber can access any network at any time, considered the right modern 
or layer 1 and layer 2 access module is provided. Reference is made to 
the Open Systems Interconnect (OSI) node!. 

By adopting the proposed solution, as described in 
the embodiments of the invention, global roaming is possible between 
heterogeneous networks such as, CDMA 2000, W-LAN, EDGE and UMTS, The 
ability, with the present invention, to purchase access also opens the 
possibility for the terminal to act as an e-cornmerce platform; i.e. the 
terminal can be used to purchase anything, not just access. 

The term transport used in this specification may 
identify an access network such as CDMA 2000, tf-CDMA etc. or e.g. both 
an access network and a core IP-network, The tern access is used synonymous 
to the term transport. 

Although tne invention has been summarised above, the 
method and arrangement according to the appended independent claims define 
the scope of the invention. Various embodiments are further defined in 
the dependent claims, 

Brief description of the drawings 

The objects and advantages of the invention will be 
understood by reading the following detailed description 1r. conjunction 
with the drawings, in which: 

Figure 1 shows a schematic picture of the architecture 
for global roaming in accordance with the present invention; 



Figure 2 shows an embodiment of an anonymous payment 
fnethod in accordance with the present invention; 

Figure 3 shows a detaileo view of an embodiment of a 
local policy enforcement point in accordance with the present invention; 

Figure 4 shows a detailed view of an embodiment of a 
secure mobile portal in accordance with the present invention; 

Figure 5 is an exemplary signalling diagram illustrating 
the signalling involved in a session set up in accordance with the present 
Invention; 

Figure 6 is a detailed view of an exemplary embodiment 
of the terminal in accordance with the present invention; 

Figure 7 shows schematically a Policy Domain (PD) in 
accordance with the present invention; and 

Figure 8 shows a mixed access scenario in accordance 
with the present indention* 

Figure 9 shows in a schematic overview terminal 
functions in accordance with the present invention. 

Detailed description 

The various features of the invention will now be 
described with reference to the figures, in which like parts are identified 
with the same reference characters. In the following description* for 
purpose of explanation and not limitation, specific details are sat forth, 
such as particular circuits, components, techniques, etc. in order to 
provide a thorough understanding of the present invention. However, it 
will be apparent to one skilled in the art that the present invention may 
be practised in other embodiments that depart from these specific details. 
In other instances, detailed descriptions of well-known methods, devices 
and circuits are omitted so as not to obscure the description of the 
present invention. 

This detailed description begins with a description 
of a network architecture providing for global roaming, then a description 
of embodiments of a mobile terminal that supports multiple access global 
roaming in such a network follows. 

The present invention provides a mobile terminal that 
supports access independent global roaming between heterogeneous networks 
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and solves the problem with policy enforcement and service transparency 
in and between different networks* The solution contains a number of 
salient features, 

1) A client-server relationship. 

5 2) A transparent "packet pipe", interconnecting servers 

and clients on a Quality of Service basis, transporting packets, 
3) A Policy Definition Paint (PDF) associated with or 

residing within a server or server cluster defining policies pertaining 
to services, authentication, authorization accounting, and 
10 4) A Policy Enforcement Point (PEP), associated with or 

residing in the cl ient , enforcing pol icies defined in the pol icy definition 
point, at the terminal (client). 

5) Separate charging mechanisms for access and services, 

i.e. client-server based transactions, 
15 6) A transformation of the access node into a point of 

sale for access, offering transparent IP transport. 

7) Removable and interchangeable layer 1 and layer 2 access 

modules (modems) for the clients (terminals) for accessing different fixed 

and mobile standards. 
20 The solution according to the invention will now be 

further described in more detail with references to figures 1-7. 

Figure 1 shows a schematic picture of an architecture 

for global roaming according to the invention. The architecture can be 

divided into a service domain (non-shaded) , and a transport domain 140 
25 (shaded). 

The service domain, which covers the higher layers, 
e.g. OSI-model, consists of a server cluster called Secure Mobile Portal 
(SHP) 100 and a client* governed by a Local Policy Enforcement Point (LPEP) 
110 residing in the client or terminal 120, A secure encrypted packet 

30 transportation tunnel 130 connects the SMP 100 and the LPEP 110 in a 
Client-Server relationship, This tunnel is enabled by the establishment 
of shared secrets between the SMP 100 and the LPEP 110, contained in a 
policy, which is used to generate encryption keys for the packets, e.g. 
IP (Internet Protocol) packets. Since each IP packet is encrypted with 

35 a unique key, i.e. a shared secret between the service provider and the 
service buyer, each packet received by the SHP 100 will be seen as a de 




facto authentication of the service buyer or subscriber by the service 
provider. 

The SMP 100 acts as a Percy Definition Paint (POPj 
for the LPEP 110 defining policies with respect ts services, authentication 
of subscribers, authorization to access and services, accounting, mobil ity 
and security for the subscriber. Tha LPEP 110 residing in the client 120 
enforces the po 1 icies defined in the SMP 100 A feature of the architecture 
is that charging for transport arc services can be separated!. Transport 
can be paid for in real-time using, for exaro^e, a pre-paid card, credit 
card, a cash card or the like. Transactions m the service domain can be 
paid for as usual e.g. as per invoice, for example. 

The transport domain, consisting of &n IP based core 
network. 140 and IP based acce$s networks such a$ designated by the acronyms 
CDMA 2000-, EDGE-; W-LAN-. W-CDMA- or fixed or cable networks, transports 
packets from the SMP 100 to the LPEP 110, The laya>* I and layer 2 part 
150 of the client or- terminal 120 also belongs to the transport domain 
and is preferably implemented as Interchangeable modules (n?ode?ns) for 
different access standards such as K-CDMA, EDGE, CDMA 2000, W-LAN etc, 
The transport domain not necessarily adds value to the packets, except 
that it classifi&s the packets according to Quality of Service and 
transports the packets to the end destination, guaranteeing access tc 
physical resources where this u appropriate. 

The different access neb/am in the transport domain 
must have the appropriate interfaces and support agreed on Quality of 
Service definitions, a so-called packet pipe 130. The packet pipe 130 
provides layer 1 and layer 2 functions to convey packet data traffic across 
radio air interfaces, for example. As part of tfta transport domain, the 
access networks must also bQ able to process charging information in the 
embodiment of the inventicn wherein transport charging is independent of 
service charging. That is, wherein access charging is independent from 
any other charging, and is seen as a separate entity. The transport domain 
thus involves Teans far charging a subscriber for transport used, e.g. 
via a pre-paia card, credit card, cash card or other tneans, It is not 
necessary that a subscriber is authenticated or authorised by a service 
provider before transport charging takas place. It is only necessary tc 
validate the pre-oaid card, credit card, cash card or the like, i.e. it 
is possible to implement anonymous payment methods for transport, Access 
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providers can accept different types of payment methods for payment of 
transport; e.g. some access providers nay accept all major credit cards 
and their own special cash card for paying for access to their networks. 
This can be compared to when stores hai/e a sticker on the entrance 
Informing what credit cards they accept, for example. 

In figure ? 1s an exemplifying embodiment of an 
anonymous payment method shown. The terminal 120 transmits a random access 
channel (in GSM typically the RACCtf) including payment information 200 
to an access node 210. The payment information identifies the Credential 
Verifier (CV) 220 e.g. the issuer of a credit card or an access 
subscription, the identity of the subscriber in an encrypted form and the 
credit verification in an encrypted font, e.g. a credit card number. This 
information is received in the access node 210 which reads out the address 
to the CV 220 adds a transaction nu-ber to the user identity and credit 
verification and transmits that infcrration 230 to the identified CV 220 
e.g. a MasterCard™ server* T he CV 220 decrypts the packets sent front the 
access node 210 with unique keys tar that particular subscriber and 
checks whether the user identity and the credit verification number are 
correct. In this way the subscriber can be uniquely identified and thus 
authenticated. If the relationship between the user identity and the credit 
verification is correct the CV 220 transmits a message with the same 
transaction number and a positive acknowledgement 240 back to the access 
node 210. The access node then returns a message 250 to a modern/router 
Interface contained in the terminal 120 containing an IP-address and * 
positive acknowledgement, granting access. The IP-address is stored in 
the modem/router interface arid in the LPEP 110 and is associated with a 
service requested by the subscriber in the service layers 260, 

The structure ana operation of an exemplary embodiment 
of the LPEP 110 resident In the client or terminal 120 will now be 
described in more detail #ith reference to fioure 3 of the drawings. 
As discussed above, the LPEP 110 enforces policies with respect to 
authentication of sUDscribers, authorization to access and services, 
accounting, mobility and security for the subscribers) that the LPEP 110 
serves. These policies are defined in trie SMF 100 that acts as a PDP for 
the LPEP 110. Each LPEP 110 has a set of policies associated with it and 
the relationship between the POP and the LPEP 110 i.e. oetween the SMP 100 
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and the subscriber is uniquely defined by these policies in the LPEP 
authorization database 300. 

Each relation that the subscriber has with SMP's 100 
or CV's 220 is defined with a number of parameter's 310. In the embodiment 
S shown at least four parameters have been defined. These are obligations, 
rights, and a shared secret, i.e. s unique identity and an encryption key, 
and an IP-address to the SMP 100 or the CV 220. These relations are 
negotiated either in real time using public key infrastructure or by 
signing up for a service and receiving the obligations, rights, shared 

10 secret and IP-address 310 to the SMP 100 or CV 220 by mail, for example, 

The LFEP 110 is also responsible for authenticating 
the subscriber via e.g. a PIN-code or a fingerprint reader, [f the 
subscriber is authorised he gains access to the LPEP 110. It is possible 
that the LPEP HO serves mare than one subscriber, then the authentication 

15 database 320 stores several subscribers A, B, . 330 and their 
corresponding identification keys key 1. key t, . 340. The LPEP key 350 
on the other hand is used for identifying the LPEP 110 to the SHP 100 and 
for encrypting the traffic between the LPEP 110 and the SHP 100 or CV 220. 

During a communication session the LPEP 110 maintains 

20 an accounting log 360 containing accounting information 370 pertaining 
to the session, such as start time, stop x i me dnd service utilised. This 
accounting lag 360 can be used by the SMP ICO for billing and auditing 
purposes. At completion of the session tne LPEP 110 can forward the 
accounting log 360 to the SMP 100 and the SMP 100 replies in agreement 

25 . or disagreement, i.e. compare the accounting log in the SMP 100 with the 
one generated in the LPEP 110. Alternatively the accounting log 350 is 
transmitted from the LPEP 110 to the SMP 100 at regular intervals, such 
as at the end of the day. 

With reference now to figure 4 of the drawings, the 

30 structure and operation of an exemplary arrbcoiment of the SMP 100 will 
be described in nore detail. As discusses above, the SMP 100 defines 
policies with respect to authentication of subscribers, authorization to 
access and services, accounting, mobility and security for the subscribers 
that the SMP 100 serves. Thus, the SMP 100 contains an Encrypted Subscriber 

35 Register (ESR) 400 carrying subscriber IP addresses or network address 
identifiers (NA1)« e.g. n,n9te1 ia.moft , as well as encryption keys for each 
individual subscriber and service that the SMP 100 serves* This, to provide 
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encryption, authentication and autnorizatlon to the services provided. 
The SMP 100 also contains a Global Location Register (SLR) 410 indicating 
which access networks tna subscriber presently is residing (visiting) in. 
To be able to provide voice services the SMP 100 alsa contain a voice 

5 server 420 for providing e.g. voice over IP, The SMP 100 can be seen as 
a server cluster providing both secure and non-secure services to the 
subscriber; secure services like e-comraerce 430, security alarmSi health 
cars services, etc, and r.on-secure services like web browsing 440 and 
catalcgue/inforraatlon services 45Q> for example. The SMP 100 also contains 

10 a secure accounting server 450 for accounting and auditing of records. 
The SMP 100 can also update the policies in the LPEP 110. For example if 
the subscriber does not p<y the invoices for a particular service, that 
service can be barred. 

With reference nnw to the exsrrplary signalling diagram 

15 shown in figure 5 of the drawings, the initiation of a session will be 
described in more detail . To initiate a session a subscriber 5S0 transmits 
an authentication request 500 including subscriber identity and a 
corresponding key e.g. a personal identification number (PIN) or a 
fingerprint, to gain access to the terminal and the rights of the LPEP 110. 

20 When the subscriber 580 receives an authentication reply 505 indicating 
that the subscriber 580 is authenticated to use the terminal* a service 
request 510 is transmitted to the LPEP 110, The LPEP 110 decides on a 
suitable access depending on the service requested by the subscriber 
and transmits an access request 515 identifying the subscriber and 

25 corresponding payment information 52C, everything but the address to the 
CV encrypted by the LPEP key, to the chosen access network 585. The access 
network 585 reads the payment information and identifies the address to 
the Credential Verifier (CV) 220, generates a transaction number and adds 
the payment information, i.e. the user identity in an encrypted form and 

30 credit verification in an encrypted form, e.g. a credit card number, and 
transmits the message 525 to the CV ZZQ> The CV 220 decrypts the message 
and if the relationship between the user identity and the credit 
verification is correct the CV transmits a message with the same 
transaction number and verifies the subscriber's credentials 530, The 

35 access network 535 transmits access OK 53S together with an IP-address 
to the LPEP 110 and at the same time the access network 585 transmits a 
message 540 to the SMP 100 indicating in what network the subscriber 580 



10 

is residing in. The LPEP 110 then enacts 545 the requested service 510 
in the SMP 100 and the subscriber 530 arid the SHP conducts a session 550. 
The LPEP 110 ana the SMP 100 monitors 555 all transactions between the 
LPEF HO and the SMP 100 fot accounting purposes. To end the session the 
subscribe^ 580 transmits an end session message 560 to the LPEP 110 that 
transmits an end session message 555 to the SMP 100. When the session has 
ended the LPEP 110 sends accounting information 570 to the 5M? 100 tftai 
compares it with the accounting infernal;-; an generated in the SMP 100 and 
sends a positive or negative accounting confirmation 575 back, to the 
LPEP 110. 

With reference now to figure 6, embodiments and 
functions of the client or terminal will fee described in mere detail - The 
terminal is basically separated into three parts, an access part, a control 
part and a service part. The access part contains a number of access 
options (moderns) 6Q0a-c These access options can physically be located 
in the terminal itself or in someone eUe's terminal, or be a Bluetooth™ 
interface connecting to remote modems e.g. in the subscriber's briafcase, 
The sarvlce part contains a user interface and applicable application 
programming interfaces (API's) for the services - The control part contains 
a policy enforcement engine 610 and a policy repository 520. 

The terminal also contains a layer 2 IP switch 530 and 
a layer 3 TP router 640 between the moderns 600a-c and the applications 
interface 650. This enablas the user 560 the possibility to have several 
information flows between applications 5?0 and models 600a-c active at 
the sarre tiffe. For example can a voice over IP data flew be maintained 
through a W-CDMA network, at the same t^e as a multimedia flow ts 
maintained through a W-LAN network, while the terminal at the same time 
is receiving a best effort flow from another teminal, through a 
Bluetooth™ modem. This possibility to route a plurality of daca flows from 
a plurality of modems 600a-c is possible because of the included layer 2 
IP switch 630, and layer 3 I? routing 640, This embodiment also makes it 
possible for the terminal to hand over a communication session from one 
commutations network to another, by re-routing the data flow from one 
moderc port to another, 

The access discovery function 580 of the terminal is 
continuously active* scanning the surroundings far access possibilities 
and generates a record of all available access possibilities. The access 
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selection function 69G is responsible for requesting access and presenting 
credentials to the desired access network depending on the service 
requested from the service lasers and also for preparing to interconnect 
with the chosen access network. 

5 The policy enforcement engine 620 and the policy 

repository 520 in the control part connect the modems 500a-c in the 
access part with the user 650 and the API's in the service part, More 
specifically the policy enforcement engine 610 in the control part has 
the responsibility for a variety of tasks such as authenticating the user 

10 660 to the terminal, authorising the user 560 tc services and collecting 
accounting data. These and other tasks will be further described in 
relation to figure 8* 

The policy repository 520 of the terminal can be seen 
as a database containing the subscribers relationship to access providers, 

15 service providers as well as individual clients, 1,e, the obligations, 
rights, shared secrets and addresses lo credential verifiers or SMP's. 
These relationships can be varying and sometimes extremely complex, Also 
these relationships may need to be updated at any time. 

Some service providers may e.g. have a hierarchical 

20 relation between different aspects of its service. For example a special 
access network or a special gateway might need to be used or passed before 
a particular service can be executed and perhaps a trusted relationship 
will have to be enacted for a particular session. Other service provider 
might be non-hierarchical, which means that tne different services are 

25 open and enacted at the same level, e.g. in that any access network may 
be used. 

A subscriber may have a relationship to many different 
structures, hierarchical and flat. For example, subscriber A has a private 
subscription with provider X for voice and wab browsing* Under the voice 

30 service, subscriber A communicates following a specific policy with 
subscriber B* Subscriber A also has a specific business relationship to 
subscriber C s such that all packets to subscriber C will be encrypted and 
directly transferred to subscriber C. In addition to his private 
subscription with provider X and his occupational relationship with 

35 subscriber C, subscriber A may also be a member of an exclusive business 
club that operates a club server. His club membership fee provides 
subscriber A encrypted voice and data traffic services to all other members 
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of the business club. The bank at which subscriber A has an account, may 
also operate a server of their own, and nay have deployed a policy in the 
terminal of subscriber A, such that he always can access his bank account, 
even at midnights , Both the bank and the business club need to purchase 
5 the service of some MSP, in order to knew the whereabouts of subscriber 
A, that 1s unless the bank or business club operates an MSP themselves. 
All these relationships are reflected in the policy repository 620. 

Each relationship a user 660 or subscriber would like 
to enter into is defined using a number of at least three or four 
10 parameters. These are rights, obligations, shared secret, and address to 
a credential verifier or SMP, thus creating a policy block. The policy 
repository 520 contains several policy blocks defining the relationships 
that exists between the user 660 and different service providers as well 
as individuals. 

15 The policy repository 620 can be accessed from outside 

695 of the terminal providing the user has opsned the policy repository 
620 by e,g- a personal identification code, a fingerprint reading or other 
means. Then a service provider can update their policy block ana relevant 
coupling coefficients* Once the service provider has entered its policies 

20 into the policy repository 520 these can be updated at will by the service 
provider providing such an agreement exists. If no such agreement exists 
the subscriber must open the policy repository 6ZQ every time before 
changes can be made. 

The policy enforcement engine 610 thus enforces policies 

25 defined in policy repositories 520. This implies e.g. that rental cars, 
hotel rooms etc, can be provided with policy enforcement engines 610 
executing the policies in a user's <k visiter's policy repository 620, 
Both the policy enforcement engine 510 and the policy repository 620 is 
preferably implemented as computer programs on a suitable raedia, e.g* smart 

30 cards together with a suitable wireless access product such as Bluetooth 1 * 1 . 
Other implementations are of course possible, e.g. integrated circuits, 
a circuit boa^d in the terminal or as a separate circuit board that can 
be inserted into any appropriate terminal. 

Figure 7 shows a so-called Policy Domain (PD) and sub- 

35 domain* The policy domain contains multiple policy blocks 625 which contain 
all the specific relationships existing between the user and service 
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providers, as well as individuals, Eacn policy domain may contain sub- 
domains 635 defining a reserved domain space for a particular application. 

A coup] ing matrix ts defined between the policy blocks, 
defining their hierarchical relationship. Relationships between policy 

5 blocks xi, yj and policy blocks xk, yl are determined by a coupling 
coefficient K, ij, kl * If the coupling coefficient is 0, than there is 
no relationship. If the coupling coefficient is +1, than block k,l is 
dependent on block i.j implying that b^ock i J has a higher position in 
the hierarchy than block k,l and that block ij must be enacted before 

10 block k 3 l . 

If the coupling coefficient is -1, than block kj 
supersedes block i,j, implying that block i,j has a lower position in the 
hierarchy than block k,l. 

With rsfsrence now to both figure 6 and S the tasks 

15 of the control part of the tenunal will be described in more detail 
together w*th a mixed access scenario, Suppose that tne access 
possibilities consists of several different networks, such as W-CDMA 700. 
EDGE 705, GPRS 710, CDMA-20DQ 715, W-LAN 720 or Fixed or Cable 725 and 
that the transport network is an IP based tore network 730. To gain access 

20 to the functions of the terminal and the policy enforcement engine 610 
and policy repository 620 the usar 660 must be authenticated. Thus ar. 
authentication request 1$ transmitted to tne polky enforcement engine 
610 that checks the authentication with the relevant pol icy blocKs In the 
policy repository 520, When the u:er 550 is authenticated all the rights 

25 and oblations associated with -he user in the policy repository 520 an* 
open. 

The access discovery function 530, which is continuously 
active, has scanned all available access networks and found the above 
mentioned access possibilities 7QQ-725 and tsade a record of what is 

30 available. The user 650 now e.g. wants to initiate a web-service and thus 
via the applications interface 550 agree on parameters, i.e. some Cuality 
of Service value for the session, e.g. the transmission rate. The 
applications interface 650 thereafter asks the policy enforcement engine 
610 to enact the requested web-service. The policy enforcement engine 610 

35 then collects data from the policy repository 620 and the access selection 
function S90 to set up a channel that complies with the agreed parameters 
and the requested service and thereafter activates the connection. 
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If the user 860 does not nave a subscription to the 
requested network, the policy enforcement engine 610 presents credentials 
to the appropriate access supplier. The credentials can e.g. be a credit 
card accepted by the access supplier. The policy enforcement engine 610 

5 then launches the requested web-service according to the policies in the 
policy repository 620. The policy enforcement engine 510 tracks data 
exchanged during the executed web-service according to policies for 
accounting and Verification purposes. Then the policy enforcement engine 
510 disconnects the application 670 and assembles the accounting data. 

10 Another possibility occurs if the terminal does not 

have the appropriate modem 600a-c for the best access network. Imagine 
for example that the GPRS network 710 is most suitable for the requested 
web-service but the user terminal only has a W-CDMA interface, The solution 
is the Bluetooth™ modern 740 a-b attached tc the terminal, which makes it 

15 possible to use the modems 6Q0a-c of a neighbouring terminal. The 
Bluetooth™ modem 740a-b in the neighbouring terminal then acts as an 
access point or bridge to access the SPRS nodem of the other terminal . 

The user or subscriber physical owns the PEP* The 
content of the PEP can be the ownership of many parties. The subscriber 

20 controls access to the PEP, and can delegate these rights to another party, 
for example an operator, or other service provider. The PD and its sub- 
domains can be accessed from outside, providing the user Initially opens 
the PD (by a card opening PIN or by other neans). The service provider 
can enter its policy blocks, as well as the relevant coupling factors that 

25 define the relationship between the pol icies of the service operator. Ones 
the service provider has entered its policies into the PEP, these can be 
updated at will by The service provider, providing such an agreement 
exists. If there is no such agreement, then tne PD must be opened each 
time by default, for example. 

30 The LPEP can be realized physically in many different 

ways. Ix can be on board in a mobile terminal, it can be part of a network 
termination equipment in the residence, it can be a separate board which 
can be inserted into any appropriate terminal when the user wishes to make 
a call 3 or it can be a separate PEP board encapsulated together with a 

35 suitable wireless access product (such as Bluetooth 1 *). The PEP may 
communicate with the client that the subscriber wishes to use for 
communication according to the principles defined above, 



W 15 

Figure 9 shows, by way cf overview, in a schenatic 
manner a client or terminal having several interchangeable rodsms (layer 1, 
layer 2, layer n) . The policy enforcement point of the terminal 

authenticates, authorizes, negociates and requests access, presents 
5 credentials, connects service and access, decrypts and encrypts IPpayload, 
collects accounting data* transmits accounting record, updates policies 
from the operator, and other, all as disclosed above in accordance with 
the present invention. 

The invention being thus described, it will be obvious 
1Q that the same may be varied in many ways. Such variations are not to be 
regarded as a departure from she scope of the invention, and all such 
modifications as would be appreciated by a person skilled in art are 
intended to be included within the sccpe of the following claims* 



